gnsrecord_crypto.c File Reference

API for GNS record-related crypto. More...

#include "platform.h"
#include "gnunet_util_lib.h"
#include "gnunet_constants.h"
#include "gnunet_signatures.h"
#include "gnunet_arm_service.h"
#include "gnunet_gnsrecord_lib.h"
#include "gnunet_dnsparser_lib.h"
#include "gnunet_tun_lib.h"

Include dependency graph for gnsrecord_crypto.c:

Go to the source code of this file.

Data Structures
struct	KeyCacheLine
	Line in cache mapping private keys to public keys. More...

Macros
#define	LOG(kind, ...)   GNUNET_log_from(kind, "gnsrecord", __VA_ARGS__)
#define	CSIZE   64

Functions
static void	derive_block_aes_key (struct GNUNET_CRYPTO_SymmetricInitializationVector *iv, struct GNUNET_CRYPTO_SymmetricSessionKey *skey, const char *label, const struct GNUNET_CRYPTO_EcdsaPublicKey *pub)
	Derive session key and iv from label and public key. More...
struct GNUNET_GNSRECORD_Block *	block_create (const struct GNUNET_CRYPTO_EcdsaPrivateKey *key, const struct GNUNET_CRYPTO_EcdsaPublicKey *pkey, struct GNUNET_TIME_Absolute expire, const char *label, const struct GNUNET_GNSRECORD_Data *rd, unsigned int rd_count)
	Sign name and records. More...
struct GNUNET_GNSRECORD_Block *	GNUNET_GNSRECORD_block_create (const struct GNUNET_CRYPTO_EcdsaPrivateKey *key, struct GNUNET_TIME_Absolute expire, const char *label, const struct GNUNET_GNSRECORD_Data *rd, unsigned int rd_count)
	Sign name and records. More...
struct GNUNET_GNSRECORD_Block *	GNUNET_GNSRECORD_block_create2 (const struct GNUNET_CRYPTO_EcdsaPrivateKey *key, struct GNUNET_TIME_Absolute expire, const char *label, const struct GNUNET_GNSRECORD_Data *rd, unsigned int rd_count)
	Sign name and records, cache derived public key (also keeps the private key in static memory, so do not use this function if keeping the private key in the process'es RAM is a major issue). More...
int	GNUNET_GNSRECORD_block_verify (const struct GNUNET_GNSRECORD_Block *block)
	Check if a signature is valid. More...
int	GNUNET_GNSRECORD_block_decrypt (const struct GNUNET_GNSRECORD_Block *block, const struct GNUNET_CRYPTO_EcdsaPublicKey *zone_key, const char *label, GNUNET_GNSRECORD_RecordCallback proc, void *proc_cls)
	Decrypt block. More...
void	GNUNET_GNSRECORD_query_from_private_key (const struct GNUNET_CRYPTO_EcdsaPrivateKey *zone, const char *label, struct GNUNET_HashCode *query)
	Calculate the DHT query for a given label in a given zone. More...
void	GNUNET_GNSRECORD_query_from_public_key (const struct GNUNET_CRYPTO_EcdsaPublicKey *pub, const char *label, struct GNUNET_HashCode *query)
	Calculate the DHT query for a given label in a given zone. More...

Detailed Description

API for GNS record-related crypto.

Author

Martin Schanzenbach

Matthias Wachs

Christian Grothoff

Definition in file gnsrecord_crypto.c.

Macro Definition Documentation

LOG

#define LOG	(		kind,
			...
	)		GNUNET_log_from(kind, "gnsrecord", __VA_ARGS__)

Definition at line 38 of file gnsrecord_crypto.c.

CSIZE

#define CSIZE   64

Referenced by GNUNET_GNSRECORD_block_create2().

Function Documentation

derive_block_aes_key()

static void derive_block_aes_key ( struct GNUNET_CRYPTO_SymmetricInitializationVector *  iv, struct GNUNET_CRYPTO_SymmetricSessionKey *  skey, const char *  label, const struct GNUNET_CRYPTO_EcdsaPublicKey *  pub  )

static

Derive session key and iv from label and public key.

Parameters

iv	initialization vector to initialize
skey	session key to initialize
label	label to use for KDF
pub	public key to use for KDF

Definition at line 50 of file gnsrecord_crypto.c.

References GNUNET_CRYPTO_kdf().

Referenced by block_create(), and GNUNET_GNSRECORD_block_decrypt().

{
  static const char ctx_key[] = "gns-aes-ctx-key";
  static const char ctx_iv[] = "gns-aes-ctx-iv";

  GNUNET_CRYPTO_kdf(skey, sizeof(struct GNUNET_CRYPTO_SymmetricSessionKey),
                    pub, sizeof(struct GNUNET_CRYPTO_EcdsaPublicKey),
                    label, strlen(label),
                    ctx_key, strlen(ctx_key),
                    NULL, 0);
  GNUNET_CRYPTO_kdf(iv, sizeof(struct GNUNET_CRYPTO_SymmetricInitializationVector),
                    pub, sizeof(struct GNUNET_CRYPTO_EcdsaPublicKey),
                    label, strlen(label),
                    ctx_iv, strlen(ctx_iv),
                    NULL, 0);
}

Here is the call graph for this function:

Here is the caller graph for this function:

block_create()

struct GNUNET_GNSRECORD_Block* block_create	(	const struct GNUNET_CRYPTO_EcdsaPrivateKey *	key,
		const struct GNUNET_CRYPTO_EcdsaPublicKey *	pkey,
		struct GNUNET_TIME_Absolute	expire,
		const char *	label,
		const struct GNUNET_GNSRECORD_Data *	rd,
		unsigned int	rd_count
	)

Sign name and records.

Parameters

key	the private key
pkey	associated public key
expire	block expiration
label	the name for the records
rd	record data
rd_count	number of records

Returns

NULL on error (block too large)

Definition at line 83 of file gnsrecord_crypto.c.

References GNUNET_TIME_Absolute::abs_value_us, derive_block_aes_key(), GNUNET_GNSRECORD_Block::derived_key, GNUNET_GNSRECORD_Data::expiration_time, GNUNET_GNSRECORD_Block::expiration_time, GNUNET_GNSRECORD_Data::flags, GNUNET_assert, GNUNET_break, GNUNET_CRYPTO_ecdsa_key_get_public(), GNUNET_CRYPTO_ecdsa_private_key_derive(), GNUNET_CRYPTO_ecdsa_sign(), GNUNET_CRYPTO_symmetric_encrypt(), GNUNET_free, GNUNET_GNSRECORD_MAX_BLOCK_SIZE, GNUNET_GNSRECORD_records_get_size(), GNUNET_GNSRECORD_records_serialize(), GNUNET_GNSRECORD_RF_RELATIVE_EXPIRATION, GNUNET_malloc, GNUNET_memcpy, GNUNET_OK, GNUNET_SIGNATURE_PURPOSE_GNS_RECORD_SIGN, GNUNET_TIME_absolute_add(), GNUNET_TIME_absolute_get(), GNUNET_TIME_absolute_hton(), payload, GNUNET_CRYPTO_EccSignaturePurpose::purpose, GNUNET_GNSRECORD_Block::purpose, GNUNET_TIME_Relative::rel_value_us, GNUNET_GNSRECORD_Block::signature, and GNUNET_CRYPTO_EccSignaturePurpose::size.

Referenced by GNUNET_GNSRECORD_block_create(), and GNUNET_GNSRECORD_block_create2().

{
  ssize_t payload_len = GNUNET_GNSRECORD_records_get_size(rd_count,
                                                          rd);
  struct GNUNET_GNSRECORD_Block *block;
  struct GNUNET_CRYPTO_EcdsaPrivateKey *dkey;
  struct GNUNET_CRYPTO_SymmetricInitializationVector iv;
  struct GNUNET_CRYPTO_SymmetricSessionKey skey;
  struct GNUNET_GNSRECORD_Data rdc[GNUNET_NZL(rd_count)];
  uint32_t rd_count_nbo;
  struct GNUNET_TIME_Absolute now;

  if (payload_len < 0)
    {
      GNUNET_break(0);
      return NULL;
    }
  if (payload_len > GNUNET_GNSRECORD_MAX_BLOCK_SIZE)
    {
      GNUNET_break(0);
      return NULL;
    }
  /* convert relative to absolute times */
  now = GNUNET_TIME_absolute_get();
  for (unsigned int i = 0; i < rd_count; i++)
    {
      rdc[i] = rd[i];
      if (0 != (rd[i].flags & GNUNET_GNSRECORD_RF_RELATIVE_EXPIRATION))
        {
          struct GNUNET_TIME_Relative t;

          /* encrypted blocks must never have relative expiration times, convert! */
          rdc[i].flags &= ~GNUNET_GNSRECORD_RF_RELATIVE_EXPIRATION;
          t.rel_value_us = rdc[i].expiration_time;
          rdc[i].expiration_time = GNUNET_TIME_absolute_add(now, t).abs_value_us;
        }
    }
  /* serialize */
  rd_count_nbo = htonl(rd_count);
  {
    char payload[sizeof(uint32_t) + payload_len];

    GNUNET_memcpy(payload,
                  &rd_count_nbo,
                  sizeof(uint32_t));
    GNUNET_assert(payload_len ==
                  GNUNET_GNSRECORD_records_serialize(rd_count,
                                                     rdc,
                                                     payload_len,
                                                     &payload[sizeof(uint32_t)]));
    block = GNUNET_malloc(sizeof(struct GNUNET_GNSRECORD_Block) +
                          sizeof(uint32_t) +
                          payload_len);
    block->purpose.size = htonl(sizeof(uint32_t) +
                                payload_len +
                                sizeof(struct GNUNET_CRYPTO_EccSignaturePurpose) +
                                sizeof(struct GNUNET_TIME_AbsoluteNBO));
    block->purpose.purpose = htonl(GNUNET_SIGNATURE_PURPOSE_GNS_RECORD_SIGN);
    block->expiration_time = GNUNET_TIME_absolute_hton(expire);
    /* encrypt and sign */
    dkey = GNUNET_CRYPTO_ecdsa_private_key_derive(key,
                                                  label,
                                                  "gns");
    GNUNET_CRYPTO_ecdsa_key_get_public(dkey,
                                       &block->derived_key);
    derive_block_aes_key(&iv,
                         &skey,
                         label,
                         pkey);
    GNUNET_break(payload_len + sizeof(uint32_t) ==
                 GNUNET_CRYPTO_symmetric_encrypt(payload,
                                                 payload_len + sizeof(uint32_t),
                                                 &skey,
                                                 &iv,
                                                 &block[1]));
  }
  if (GNUNET_OK !=
      GNUNET_CRYPTO_ecdsa_sign(dkey,
                               &block->purpose,
                               &block->signature))
    {
      GNUNET_break(0);
      GNUNET_free(dkey);
      GNUNET_free(block);
      return NULL;
    }
  GNUNET_free(dkey);
  return block;
}

Here is the call graph for this function:

Here is the caller graph for this function: